feat: update frontend to use cookie session

* use SessionMiddleware in socket.io server
* add back jwtStrategy for commands

server/src/api/controllers/authController.js

@@ -118,6 +118,6 @@ export function logout(req, res) {
       })
       return
     }
-    res.json({ message: 'success' })
+    res.redirect('/login')
   })
 }

server/src/api/routes/index.js

@@ -4,9 +4,9 @@ import sessions from './sessions.js'
 import quests from './quests.js'
 import commands from './commands.js'
 import authRouter from './auth.js'
+import authRequired from '../../middleware/authRequired.js'
 
 const router = Router()
-router.use(passport.authenticate('session'))
 
 router.get('/', (req, res) => {
   res.send('Hello API!')
@@ -15,10 +15,11 @@ router.get('/', (req, res) => {
 router.use('/auth', authRouter)
 router.use('/quests', quests)
 
-const authZone = Router()
-authZone.use('/sessions', sessions)
-authZone.use('/commands', commands)
-
-router.use(authZone)
+router.use('/sessions', authRequired, sessions)
+router.use(
+  '/commands',
+  passport.authenticate('jwt', { session: false }),
+  commands
+)
 
 export default router

server/src/api/socket.js

@@ -1,7 +1,8 @@
 import { Server } from 'socket.io'
 import { getAndStartContainer, attachContainer } from '../containers/docker.js'
 import Session from '../models/session.js'
-import { genJWT, verifyJWT } from '../utils/auth.js'
+import SessionMiddleware from '../middleware/session.js'
+import { genJWT } from '../utils/auth.js'
 
 const sessions = new Map()
 
@@ -27,6 +28,13 @@ export function pushToSession(sessionId, event, ...args) {
 
 async function connectClient(socket) {
   console.log('Connected to the client.')
+
+  const user = socket.request.session?.passport?.user
+  if (!user) {
+    socket.send('User not found.')
+    socket.disconnect()
+    return
+  }
   const sessionId = socket.handshake.query.session_id
   if (!sessionId) {
     socket.send('Session ID not found.')
@@ -36,7 +44,7 @@ async function connectClient(socket) {
 
   const session = await Session.findOne({
     _id: sessionId,
-    user: socket.user,
+    user,
     status: 'active',
   })
   if (!session) {
@@ -89,24 +97,7 @@ async function connectClient(socket) {
 export default (server) => {
   const io = new Server(server)
 
-  io.use(async (socket, next) => {
-    console.log('Authenticating...')
-    try {
-      const { token } = socket.handshake.auth
-      if (!token) {
-        next(new Error('Token not found.'))
-        return
-      }
-      const user = await verifyJWT(token)
-      // eslint-disable-next-line no-param-reassign
-      console.log(user)
-      socket.user = user
-      next()
-    } catch (err) {
-      console.error(err)
-      next(err)
-    }
-  })
+  io.engine.use(SessionMiddleware)
 
   io.on('connection', connectClient)
 }

server/src/auth/jwtStrategy.js

@@ -0,0 +1,13 @@
+import { Strategy as JwtStrategy, ExtractJwt } from 'passport-jwt'
+import config from '../config.js'
+
+const jwtOptions = {
+  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+  secretOrKey: config.jwtSecret,
+}
+
+function verifyJwt(jwtPayload, done) {
+  return done(null, jwtPayload)
+}
+
+export default new JwtStrategy(jwtOptions, verifyJwt)

server/src/auth/passport.js

@@ -1,7 +1,9 @@
 import passport from 'passport'
 import PasswordStrategy from './passwordStrategy.js'
+import JwtStrategy from './jwtStrategy.js'
 
 passport.use(PasswordStrategy)
+passport.use(JwtStrategy)
 
 passport.serializeUser((user, done) => {
   process.nextTick(() => {

server/src/index.js

@@ -3,6 +3,7 @@ import express from 'express'
 import http from 'http'
 import YAML from 'yaml'
 import swaggerUI from 'swagger-ui-express'
+import passport from 'passport'
 
 import './auth/passport.js'
 import socketServer from './api/socket.js'
@@ -16,7 +17,7 @@ import expiryRemovalScheduler from './containers/expiryChecker.js'
 import { createTestUser } from './utils/auth.js'
 
 async function main() {
-  const db = await connectDB()
+  await connectDB()
 
   await createTestUser()
 
@@ -30,7 +31,8 @@ async function main() {
   const server = http.createServer(app)
   socketServer(server)
   app.use(errorHandler)
-  app.use(sessionMiddleware(db))
+  app.use(sessionMiddleware)
+  app.use(passport.session())
   app.use(
     '/api-docs',
     swaggerUI.serve,

server/src/middleware/authRequired.js

@@ -0,0 +1,9 @@
+export default function authRequired(req, res, next) {
+  if (req.isAuthenticated()) {
+    next()
+    return
+  }
+  res.status(401).json({
+    message: 'not authenticated',
+  })
+}

server/src/middleware/session.js

@@ -3,18 +3,15 @@ import MongoStore from 'connect-mongo'
 
 import config from '../config.js'
 
-export default (db) => {
-  console.log(db.constructor.name)
-  return session({
-    secret: config.jwtSecret,
-    resave: false,
-    saveUninitialized: false,
-    cookie: {
-      httpOnly: true,
-    },
-    store: MongoStore.create({
-      mongoUrl: config.db,
-      collectionName: 'loginSessions',
-    }),
-  })
-}
+export default session({
+  secret: config.jwtSecret,
+  resave: false,
+  saveUninitialized: false,
+  cookie: {
+    httpOnly: true,
+  },
+  store: MongoStore.create({
+    mongoUrl: config.db,
+    collectionName: 'loginSessions',
+  }),
+})